Snapshot 232271

Document
Privacy policy
URL
https://www.convertapi.com/privacy-policy
Fetched
HTTP status
200
Content type
text/html; charset=utf-8
Fetch mode
static
Size
141864 bytes
SHA-256 (raw)
81fd6162dbc65393007ce4fa01d6efbf778454a898c65cd77ce86f5cab937f19
SHA-256 (normalized text)
991543932ed0351a12cf090dff3285cadc85ee780a7ef977e505ed78ecb31330

Normalized text

Scripts and page chrome removed; this is what change detection compares.

PRIVACY POLICY AND DATA PROCESSING TERMS
Last updated: November 5, 2026
The Privacy Policy and Data Processing Terms complement the ConvertAPI Terms of Service (Master Service Agreement) and apply to data processing by UAB ConvertAPI (further referred to as “ConvertAPI”, “we”, “us” or “our”) for the Client (further referred as “Client”, “you” or “your”).
Definitions used in this Privacy Policy shall have the following meanings:
“Data protection laws” mean Regulation (EU) 2016/679 of 25 May 2018 and any mandatory national or international regulation applicable to personal data processing.
“Document” means any information, data, file, or document the Client may upload to the Services infrastructure and/or Website for the purposes of the Services.
“Services” and “Website” shall have the meaning as defined in the ConvertAPI Terms of Service (Master Service Agreement).
Other definitions shall be understood as they are defined in the Data Protection Laws and/or the ConvertAPI Terms of Service (Master Service Agreement).
HOW WE PROCESS PERSONAL DATA
ConvertAPI offers online Document processing services, which are described and defined in ConvertAPI Terms of Service (Master Service Agreement). When using such Services and Website, the Client may upload, process, and store Documents containing personal data of the Client or third parties on the Services and/or Website.
As a general rule, ConvertAPI strictly acts as a personal data processor (as detailed in Appendix No 1, second table) and accesses, collects, acquires, receives, transfers, processes, and/or uses any personal data only for the purposes of rendering the Services and ensuring proper functionality of the Website.
ConvertAPI may act as the data controller (as detailed in Appendix No 1, first table) only when processing personal data pertinent to your Services user account on the Website, and as it is needed to perform contractual obligations under ConvertAPI Terms of Service (Master Service Agreement), as well as to process your Services orders and to get in touch with you.
More detailed information about data processing by ConvertAPI is disclosed in Appendix 1.
There is no statutory obligation for you to provide your data to ConvertAPI. However, you cannot use some of our Services if you do not provide your data to us. Your decisions to provide us with your personal data and use Services for Document processing are completely voluntary.
If appropriate, we may set out the terms of this Privacy Policy and Data Processing Terms in the individual written Data Processing Agreement. However, unless the individual Data Processing Agreement is signed the terms of this Privacy Policy and Data Processing Terms will apply to all our processing of any personal data.
CATEGORIES OF PERSONAL DATA THAT ARE PROCESSED
When acting as the data processor, we transiently process only the personal data contained in the Documents. The categories and scope of such processing are entirely dependent on you. We do not independently access, store, save, process, or perform any operations on such data without your direction. Only the following conversions use artificial intelligence (AI) models (the “AI Conversions”): Document Moderation (document/to/moderate), Image Moderation (image/to/moderate), Extract PDF (pdf/to/extract), PDF to Factur-X (pdf/to/facturx), PDF to ZUGFeRD (pdf/to/zugferd), Redact PDF (pdf/to/redact), PDF Watermark Remover (pdf/to/remove-watermark) and PO Translator (po/to/translate). For the AI Conversions only, the Document, or content extracted from it (such as text or page images), is sent to our AI sub-processor indicated in Appendix No 2, solely to perform the conversion requested by you. Such data is not used by ConvertAPI or its AI sub-processor to train or improve AI models. Adding a conversion to this list is a change of sub-processor processing and is communicated in accordance with the section “Third-Party Sub-processors”.
Documents submitted to all other conversions are not processed by AI models.
When acting as the data controller, we process your IP address, Services session data and your user account data, including your email address and payment information. Our Website also uses web analysis tools and cookie tools, as described in our Cookie Policy. Cookies generate information about how you use the Website, and our server saves this information. Strictly necessary cookies are used without consent. All other cookies (preferences, statistics and marketing) are set only after you give your consent via the cookie consent banner displayed on the Website, where you can accept all cookies, select individual categories or decline them. You can change or withdraw your consent at any time via the Cookie Declaration in our Cookie Policy. You can also block cookies through your internet browser's settings; however, if you do this, you may be unable to use all of the functions on our Website.
If you pay for Services using a payment card, we do not collect and store any payment information, such as payment card numbers or verification codes. You disclose this information only to the respective payment processor used by ConvertAPI.
PURPOSES AND LEGAL BASES OF PROCESSING
When acting as the data controller, ConvertAPI processes personal data for the following purposes and on the following legal bases under Article 6(1) of Regulation (EU) 2016/679:
Providing the Services: creating and managing your user account, providing the Services, processing your orders and payments, and communicating with you about the Services. Legal basis: performance of a contract (Article 6(1)(b) of Regulation (EU) 2016/679).
Customer support: handling your support requests and enquiries. Legal basis: performance of a contract (Article 6(1)(b)).
Security and service integrity: ensuring the security, integrity and availability of the Website and Services, including operational logging and the prevention of fraud and abuse. Legal basis: our legitimate interests in protecting the Website, the Services and our Clients (Article 6(1)(f)).
Cookies and website analytics: use of preference, statistics and marketing cookies and similar technologies. Legal basis: your consent, given via the cookie consent banner (Article 6(1)(a)).
Direct marketing: where we send you information about ConvertAPI services similar to those you use. Legal basis: our legitimate interests in promoting our Services (Article 6(1)(f)), or your consent where required by applicable law. You may object or unsubscribe at any time.
Legal obligations: compliance with accounting, tax and other obligations under applicable law. Legal basis: compliance with a legal obligation (Article 6(1)(c)).
Legal claims: the establishment, exercise or defence of legal claims. Legal basis: our legitimate interests (Article 6(1)(f)).
Where ConvertAPI acts as a data processor, the Client, as the data controller, is responsible for determining the legal basis for the processing of personal data contained in Documents.
OUR DATA PROCESSING OBLIGATIONS
ConvertAPI processes personal data contained in the Documents on your behalf and only by following instructions made by you electronically (your action or direction on the Website), and only to the scope determined by you. Standard processing pertaining to personal data subjects, terms, purposes, procedure of personal data processing, also with categories of personal data subjects are listed in Appendix 1.
ConvertAPI shall immediately inform the Client if, in its opinion, an instruction infringes Regulation (EU) 2016/679 or other Union or Member State data protection provisions.
ConvertAPI ensures compliance of personal data processing with the Data protection laws and pertinent instructions by supervisory authorities. ConvertAPI has no reasonable means to, and does not verify, and has no obligation to verify that Client is a legitimate data controller for the personal data that the Client included into the Documents and processes through the Services. It is the sole responsibility of the Client to maintain the legitimacy of such data processing.
ConvertAPI may reasonably assist you in fulfilling data controller’s obligations arising from the Data protection laws, including but not limited to your obligations with respect to the data subjects rights, e.g. right of access by the data subject, right to rectification, right to erasure, right to restriction of processing.
Taking into account the nature of processing and the information available to ConvertAPI, ConvertAPI shall also reasonably assist the Client in ensuring compliance with the obligations pursuant to Articles 32 to 36 of Regulation (EU) 2016/679, including the security of processing, notification of personal data breaches, data protection impact assessments and prior consultation with supervisory authorities.
ConvertAPI will implement all appropriate technical and organisational data security measures (as detailed in Appendix No 1) to ensure security and confidentiality of data processing in accordance with the Data protection laws. ConvertAPI will not perform any action, which would cause the Client to act in violation of the Data protection laws.
ConvertAPI will not transfer or otherwise disclose any personal data or other information relating to personal data processing to any other third party, other than third-party sub-processors as described below, or authorized government institutions. ConvertAPI will notify you about situations, where it must disclose personal data processed on your behalf in order to fulfil obligations stipulated in the Data protection laws, unless this is precluded by the applicable law.
THIRD-PARTY SUB-PROCESSORS
The Services and Website are hosted on a secure third-party cloud platform, with data processing locations determined based on your configuration. For example, if you configure the API to use EU-based servers, data will be processed and stored within the EU. To deliver our Services, we may engage third-party providers for data storage and processing, ensuring compliance with applicable data protection standards. ConvertAPI is responsible for all sub-processing of personal data by such third parties.
You agree and consent that such third parties, which are listed in Appendix No 2 and described in Appendix No 1, will be engaged by ConvertAPI as sub-processors of personal data. Before engaging new or changing the existing third-party sub-processors of personal data, we will communicate and/or disclose this to you by providing third-party details and other pertinent information. The current list of sub-processors engaged by ConvertAPI, including their legal entity, the services they provide, the personal data concerned and the safeguards applied to transfers of personal data, is set out in Appendix No 2, which ConvertAPI keeps up to date. Such notice will be given at least fourteen (14) days before the new or replacement sub-processor begins processing personal data. You may object to the engagement on reasonable data protection grounds by notifying us at privacy@convertapi.com within that period. In that case, we will discuss your objection with you in good faith and, where no mutually acceptable solution is reached, you may terminate the affected Services without penalty; prepaid fees are non-refundable, except as required by applicable law or as otherwise agreed in an individual Data Processing Agreement. Where the replacement of a sub-processor is urgently required for security or service continuity reasons, ConvertAPI may engage the replacement sub-processor immediately and will notify you as soon as reasonably practicable, in which case you will have the same right to object.
ConvertAPI undertakes to execute its best efforts to ensure that all third-party sub-processors observe all applicable data protection laws and are bound by privacy rules that meet all applicable requirements required by data protection laws.
You have the right to object, at any time, to the processing of your personal data based on our legitimate interests or for direct marketing purposes.
Legitimate Interests: If our processing of your personal data is based on our legitimate interests, you may object to this processing by providing a specific reason related to your particular situation. Upon receiving your objection, we will evaluate your request and cease processing your data unless we have compelling legitimate grounds to continue or if the processing is necessary for the establishment, exercise, or defense of legal claims.
Direct Marketing: You have the absolute right to object to the processing of your personal data for direct marketing purposes at any time without providing any specific reason. If you object, we will stop using your personal data for such purposes immediately.
To exercise your right to object, please contact us at privacy@convertapi.com. We will respond to your request within the applicable legal timeframes.
TRANSFER OF PERSONAL DATA OUTSIDE THE EEA
For clients using proper domain (REST API endpoint) configuration in the European Economic Area (EEA) and for clients in the rest of the world except the United Kingdom (UK), ConvertAPI will not transfer personal data beyond the EEA without prior written consent of the Client. Upon receipt of the consent of the Client to transfer the personal data but before sending that data beyond the EEA, ConvertAPI must enter into a valid personal data transfer agreement complying with the provisions of Chapter V of Regulation (EU) 2016/679 and/or applicable international law.
For clients in the UK, ConvertAPI will process personal data only within the UK, as detailed in Appendix 1.
Certain third parties indicated in Appendix 1, namely Cloudflare, Inc., ActiveCampaign, LLC (Postmark), GitHub, Inc. and Mezmo Inc., are established in the United States, and personal data may be accessible to or processed by them in the United States. Such transfers are made on the basis of the European Commission’s adequacy decision for the EU-US Data Privacy Framework, where the recipient is certified under it, or of the Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) of Regulation (EU) 2016/679), supplemented by additional safeguards where necessary. In respect of personal data processed on behalf of the Client, the Client authorises such transfers by engaging the Services, subject to these safeguards. Information on the safeguards applied may be requested at privacy@convertapi.com.
DATA SECURITY AND DATA BREACH NOTIFICATIONS
ConvertAPI uses and maintains appropriate technical and organizational measures to ensure the security of personal data processing and to protect personal data from accidental loss, destruction, damage, theft, alteration, unauthorized disclosure or unauthorized access, and from any forms of unlawful processing. These measures shall be appropriate to the harm that might result from any unauthorized or unlawful processing, accidental loss, destruction, damage, or theft of the personal data and having regard to the nature of the personal data. Technical and organizational security measures employed are based on the regular risk assessment, as well as the nature, scope, context, and purposes of the processing, damage likelihood, and risk severity for the rights and freedoms of the data subjects.
ConvertAPI shall ensure the reliability and confidentiality obligations of all personnel who may have access to the processed personal data. Furthermore, ConvertAPI shall ensure that in each case the access to personal data is strictly limited to those individuals who need to know or access the relevant personal data, as strictly necessary for the purposes of the Services, and in compliance with the applicable Data protection laws.
ConvertAPI undertakes to timely perform all obligations under the Data protection law to assist the Client in case of a personal data breach in order to reduce negative consequences of such a breach, also to immediately notify the Client about any incident relating to personal data and unauthorised access to personal data as required by the Data protection laws.
ConvertAPI ensures that these requirements apply to all third-party sub-processors.
DATA SUBJECT RIGHTS
Data subjects shall have the right to information about personal data that we process. Where we have reasonable doubts concerning the identity of the person making a request, we may request additional information necessary to confirm it, such as confirmation from the e-mail address associated with the user account; we will request only information that is necessary and proportionate for this purpose. Data subjects also have a right to rectification or deletion or restriction of processing, as it is applicable under the applicable Data processing laws. Furthermore, in accordance with legal requirements, data subjects have the right to object to us against the processing of specific data. Data subjects also have the right to data portability, as well as the right to lodge a complaint about the processing of personal data to a competent data protection authority, including the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija, https://vdai.lrv.lt). All rights shall be executed in a reasonable and economical way. Requests are handled free of charge. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, ConvertAPI may charge a reasonable fee or refuse to act on the request, in accordance with Article 12(5) of Regulation (EU) 2016/679. ConvertAPI will respond to requests without undue delay and in any event within one (1) month of receipt; this period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case the data subject will be informed of the extension within one (1) month of receipt.
Right to withdraw consent. Where the processing of personal data is based on consent, data subjects have the right to withdraw their consent at any time by contacting privacy@convertapi.com or, in respect of cookies, via the Cookie Declaration in our Cookie Policy. Withdrawal of consent is as easy as giving it and does not affect the lawfulness of processing based on consent before its withdrawal.
Rights related to automated decision-making and profiling. ConvertAPI does not make decisions based solely on automated processing, including profiling, which produce legal effects concerning data subjects or similarly significantly affect them, within the meaning of Article 22 of Regulation (EU) 2016/679. Should this change, data subjects will be informed in advance and will have the right to obtain human intervention, to express their point of view and to contest the decision. AI models used in the AI Conversions process Documents solely at the Client's direction to perform the requested conversion, and do not make decisions concerning data subjects.
CHILDREN’S PERSONAL DATA
ConvertAPI’s Services and Website are intended for business use and are not directed at children. ConvertAPI does not knowingly collect or process personal data of individuals under the age of 18 as a data controller. If we become aware that personal data of a person under the age of 18 has been provided to us, we will delete it promptly. Where Clients upload Documents for processing, ConvertAPI acts as a data processor and the Client, as the data controller, remains solely responsible for the lawfulness of processing any personal data, including personal data of children, contained in such Documents.
DATA PROCESSING AUDIT
ConvertAPI undertakes to provide reasonable disclosures, which would be sufficient for the Client to perform data processing risk assessment and ensure that personal data processing by ConvertAPI complies with the requirements of the Data protection laws.
At Client's reasonable written request provided no less than four (4) weeks in advance and subject to advance payment of reasonable costs, ConvertAPI shall allow the Client to audit processing of the personal data of the Client. The audit shall be conducted in a way that the audit would not interfere with normal operation of the Services, Website, ConvertAPI and other clients of ConvertAPI.
Audits may be initiated by mutual agreement if there are justified causes or if a court or data protection authorities mandate them. The audit shall be conducted by a competent and independent auditor whose candidacy must be communicated in advance to ConvertAPI and allow ConvertAPI to reasonably object to unsuitable candidates.
DATA PROCESSING PERIOD AND TERMINATION OF PROCESSING
This Privacy Policy is applicable for as long as ConvertAPI processes the personal data of or on behalf of the Client. We delete all your registration data either within 24 months following the last usage of the ConvertAPI service, as soon as you delete your user account with us, or once the statutory retention period expires. Data processing shall be terminated if there are no legal grounds for processing according to the applicable laws and/or the Client requests the termination of such processing.
You can delete your user account yourself in your user account or by requesting it in writing.
Upon termination of Services, the data processing may continue in the scope required by the applicable laws.
Upon termination of the data processing, ConvertAPI shall delete and destroy all Documents and personal data provided by the Client, except data required according to the applicable law. ConvertAPI shall ensure that all third-party sub-processors comply with the data processing termination.
LIABILITY
ConvertAPI's liability for any losses resulting from the breach of the Data protection laws caused through the fault of ConvertAPI or third-party sub-processors is established according to the applicable law and in no event shall be greater than 5 (five) times the aggregate amount paid by the Client to ConvertAPI for Services during the last twelve (12) months. ConvertAPI liability is limited to direct damages.
In addition, where liability is covered under ConvertAPI’s insurance policy, liability shall extend to the applicable policy limits, provided such liability is not otherwise excluded by the terms of the Master service agreement or this policy.
DISPUTES
Any disputes resulting from data protection matters shall be settled in the Republic of Lithuania courts. The parties shall seek complete confidentiality of the information about applying to a court, information about a process of examination of a case, and a judgement confidential. Laws of the Republic of Lithuania shall apply.
CONTACT INFO AND COMMUNICATION
Data processing is done by ConvertAPI, UAB, a company registered in the Republic of Lithuania, address Lauksargio g. 111, Vilnius LT-10105, Lithuania, company code 304461332.
For all further inquiries about personal data processing by ConvertAPI, please contact ConvertAPI DPO at privacy@convertapi.com.
Appendix No 1
1. Personal data related to contract management (where we act as data controllers):
Personal data is transferred to ConvertAPI for the following purposes:	To manage contracts with Clients while providing Services by ConvertAPI
Categories of personal data being transferred:	Contract-related Personal Data may include personal contact information such as full name, phone number, and email address; details including employer name, job title and function, and business contact details; payment card-related data; IP addresses; and interest data.
Categories of data subjects:	Data subjects may include Client representatives and end users, such as employees, contractors, collaborators, partners, and Clients.
Personal data processing operations carried out by ConvertAPI:	Data deletion, storage, systematization, analysis, transfer, making copies. All these operations can be done only to provide Services.
Place of Personal data processing operations:
At ConvertAPI UAB head office in Vilnius, Lithuania.
IBM data centers: for customers using the EEA domain (REST API endpoints) located within EEA; for customers using the US domain (REST API endpoints) located within the US; for customers using UK domain (REST API endpoints) within UK. For specific IBM data center locations within each domain, please refer to https://www.convertapi.com.
Business locations of the third parties indicated below, within the EEA or, where described in the section “Transfer of Personal Data Outside the EEA”, in the United States.
Technical and organizational measures for storage of personal data:
access to Personal Data is restricted, controlled and recorded;
access to personal data has been allowed to only those employees, who require the personal data to perform their functions and only to the extent required to perform their functions.
access of unauthorized persons to premises where the personal data have been stored is strictly restricted;
upon expiry of the personal data storage period, secure destruction of the personal data is ensured;
persons, having access to the personal data, use at a minimum password of at least 10 characters long and containing uppercase letters, lowercase letters and digits and passwords are changed at least every year or if compromise is suspected.
only encrypted communication channels are utilized to transfer personal data.
Third Parties:
IBM Cloud Services, as Personal Data could be stored encrypted at IBM Cloud Services data centres, so IBM engineers can impact physical security and availability of physical equipment and computer networks.
Google Ireland Ltd. provides email and the support mailbox for ConvertAPI (Google Workspace), where personal data can be processed through e-mail communication with the client and the resolution of client requests.
Paddle.com - payment processor.
Mezmo Inc. is used for operational log storage, analysis, and alerts.
Cloudflare, Inc. provides DNS, content delivery, web application firewall and DDoS protection for the Website and Services, so IP addresses and request metadata pass through its network.
Postmark (ActiveCampaign, LLC) sends ConvertAPI's transactional e-mail (account, billing and support notifications), so recipient e-mail addresses and message content are processed.
GitHub, Inc. hosts ConvertAPI's support case records, so client contact details and the content of support requests are processed.
OpenAI Ireland Limited provides AI-generated instant answers on ConvertAPI’s support page, so the content of questions submitted by Website visitors is processed.
2. Personal data processed during Document conversion (where we act as data processors):
Personal data is transferred to ConvertAPI for the following purposes:	To provide Services by ConvertAPI to the Client.
Categories of personal data being transferred:	While using the ConvertAPI service, the Client may upload Documents containing Personal Data, which are processed using automated methods, and no persistent storage is utilized. ConvertAPI does not access the contents of Documents while Document is processed so in this case categories to be maintained by Client, and Personal Data may include personal contact information such as full name, phone number, email address; details including employer name, job title and function, business contact details; IP addresses and interest data.
Categories of data subjects:	Data subjects may include Client representatives and end users, such as employees, contractors, collaborators, partners, Clients.
Personal data processing operations carried out by ConvertAPI:	Data deletion, storage, systematization, analysis, transfer, making copies. All these operations can be done only to provide services.
Place of Personal data processing operations:	IBM data centres: for customers using EEA domain (REST API endpoints): located within EEA; for customers using US domain (REST API endpoints) located within US; for customers using UK domain (REST API endpoint) within UK. For specific IBM data centre locations within each domain, please refer to https://www.convertapi.com/. For the AI Conversions, the Document, or content extracted from it, is additionally processed by the AI sub-processor indicated below.
Technical and organizational measures for storage of personal data:
access to Personal Data is restricted, controlled and recorded;
access to personal data has been allowed to only those employees, who require the personal data to perform their functions and only to the extent required to perform their functions.
access of unauthorized persons to premises where the personal data have been stored is strictly restricted;
upon expiry of the personal data storage period, secure destruction of the personal data is ensured;
persons, having access to the personal data, use at a minimum password of at least 10 characters long and containing uppercase letters, lowercase letters and digits and passwords are changed at least every year or if compromise is suspected.
only encrypted communication channels are utilized during the transfer of personal data.
personal data is encrypted while (if) stored;
Third Parties:
IBM Cloud Services, as Personal Data could be stored encrypted (non-persistent, only temporarily storage up to 3 hours, depending on configuration used by Client) at IBM Cloud Services data centres, IBM engineers can impact physical security and availability of physical equipment and computer networks but not access Personal Data, during processing or short-term storage (if applicable).
Cloudflare, Inc. provides network security (web application firewall, DDoS protection) and traffic routing in front of the REST API endpoints, so Documents pass through its network in transit.
GitHub is used for application source code repositories.
Mezmo Inc. is used to store operational logs, analyses, and alerts.
OpenAI Ireland Limited provides the AI models used only for the AI Conversions (as listed in the section “Categories of Personal Data That Are Processed”). For these conversions, the Document, or content extracted from it, is sent to OpenAI Ireland Limited solely to perform the conversion requested by the Client. No data from any other conversion is sent to OpenAI Ireland Limited.
Appendix No 2 – List of Sub-processors
ConvertAPI engages the following sub-processors. “Part 1” refers to personal data related to contract management, where ConvertAPI acts as data controller, and “Part 2” to personal data processed during Document conversion, where ConvertAPI acts as data processor, as described in Appendix No 1. Changes to this list are communicated in accordance with the section “Third-Party Sub-processors”.
Sub-processor (country of establishment)	Service / purpose	Personal data concerned	Processing context	Location and transfer safeguards
IBM Cloud Services	Hosting of the Website and Services infrastructure (data centres).	User account data; Documents (encrypted, transient: processed in memory or stored for up to 3 hours).	Parts 1 and 2	IBM data centres in the EEA, US or UK, according to the REST API endpoint domain selected by the Client. For EEA endpoints, IBM hosting stays within the EEA.
Cloudflare, Inc. (USA)	DNS, content delivery, web application firewall, DDoS protection and traffic routing for the Website and Services.	IP addresses and request metadata; Documents in transit only.	Parts 1 and 2	Global network. EU-US Data Privacy Framework and/or Standard Contractual Clauses.
Google Ireland Ltd. (Ireland)	E-mail and support mailbox (Google Workspace).	Contact details; content of e-mail and support communications.	Part 1	EU entity. Onward transfers governed by the provider’s data processing terms (Standard Contractual Clauses).
Paddle Payments Limited (Ireland)	Payment processing (Paddle.com).	Billing and payment data. Payment card data is processed solely by Paddle.	Part 1	EU entity. Onward transfers governed by the provider’s data processing terms.
Mezmo Inc. (LogDNA) (USA)	Operational log storage, analysis and alerts.	Operational log data about conversions: date and time, duration, conversion type and account ID.	Parts 1 and 2	Log data is stored in the United States. EU-US Data Privacy Framework and/or Standard Contractual Clauses.
ActiveCampaign, LLC – Postmark (USA)	Transactional e-mail (account, billing and support notifications).	Recipient e-mail addresses; content of transactional e-mails.	Part 1	EU-US Data Privacy Framework and/or Standard Contractual Clauses.
GitHub, Inc. (USA)	Support case records; application source code repositories.	Client contact details; content of support requests. No Documents.	Parts 1 and 2	EU-US Data Privacy Framework and/or Standard Contractual Clauses.
OpenAI Ireland Limited (Ireland)	AI models for the AI Conversions and for AI-generated instant answers on the support page.	Documents or content extracted from them (AI Conversions only); questions submitted on the support page. Not used to train or improve AI models.	Parts 1 and 2	EU entity. Onward transfers governed by the provider’s data processing terms (Standard Contractual Clauses).
Ready to Streamline Your File Conversions?
Get Started for Free Contact Us